CVE-2026-90910Published
Apache Answer: Reaction API authorization bypass for restricted content
cve-program ·
Vendor product: Apache Answer
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694708 source statements · aliases may refer to the same vulnerabilityCVE-2026-112251Published
antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect
cve-program ·
Vendor product: clawhost
CVE-2026-78163Published
Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-docling
CVE-2026-78164Published
Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-http · https://repo.maven.apache.org/maven2: org.apache.camel:camel-http-common · https://repo.maven.apache.org/maven2: org.apache.camel:camel-vertx-http
CVE-2026-31533Published
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31532Published
can: raw: fix ro->uniq use-after-free in raw_rcv()
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31528Published
perf: Make sure to use pmu_ctx->pmu for groups
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31525Published
bpf: Fix undefined behavior in interpreter sdiv/smod for INT_MIN
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31516Published
xfrm: prevent policy_hthresh.work from racing with netns teardown
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31513Published
Bluetooth: L2CAP: Fix stack-out-of-bounds read in l2cap_ecred_conn_req
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31511Published
Bluetooth: MGMT: Fix dangling pointer on mgmt_add_adv_patterns_monitor_complete
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31508Published
net: openvswitch: Avoid releasing netdev before teardown completes
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31507Published
net/smc: fix double-free of smc_spd_priv when tee() duplicates splice pipe buffer
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31504Published
net: fix fanout UAF in packet_release() via NETDEV_UP race
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31488Published
drm/amd/display: Do not skip unrelated mode changes in DSC validation
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31479Published
drm/xe: always keep track of remap prev/next
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31478Published
ksmbd: replace hardcoded hdr2_len with offsetof() in smb2_calc_max_out_buf_len()
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-107436Published
WordPress Strong Testimonials plugin <= 3.3.12 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: strong-testimonials
CVE-2026-80343Published
Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-netty-http
CVE-2026-111998Published
Vanus 0.8.0 through 0.9.0 Default Admin Credentials via Gateway
cve-program ·
Vendor product: vanus
CVE-2026-80344Published
Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-as2
CVE-2026-50218Published
Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with a malicious link, an attacker can use a spoofed JWT token to inject arbitrary …
cve-program ·
Vendor product: Guardicore Platform Agent
CVE-2026-110453Published
Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.
cve-program ·
Vendor product: Nix
CVE-2026-112282Published
VideoLAN libbluray through 1.5.1 Out-of-Bounds Read via clpi_access_point
cve-program ·
https://code.videolan.org/videolan/libbluray: libbluray
CVE-2026-110907Published
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selec…
cve-program ·
Vendor product: Backdrop
CVE-2026-93483Published
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this hea…
cve-program ·
Vendor product: Znuny
CVE-2026-84176Published
Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-platform-http-vertx
CVE-2026-111445Published
Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For exists(key=), production with error information disabled returns true for an out-of-scope key inste…
cve-program ·
Vendor product: Wheels
CVE-2026-111450Published
Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If no explicit error-email recipient is configured, a mail server is configured, and the server accepts…
cve-program ·
Vendor product: Wheels
CVE-2026-112003Published
ProjectSend 2.0.0 before 2.7.0 Path Validation Bypass via Orphan File Import/Delete
cve-program ·
Vendor product: ProjectSend
CVE-2026-111853Published
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attac…
cve-program ·
Vendor product: 3 Series MDO
CVE-2026-112112Published
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With…
cve-program ·
Vendor product: BIRD
CVE-2026-112105Published
GlitterWare Passy TLS main.dart MyHttpOverrides certificate validation
cve-program ·
Vendor product: Passy
CVE-2026-84178Published
Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-oauth
CVE-2026-84181Published
Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-shiro
CVE-2026-112013Published
libtta through 2.3 Divide by Zero via tta_decoder_init_get_info
cve-program ·
https://sourceforge.net/projects/tta/: libtta
CVE-2026-112142Published
satya-vinay Events-Management-System Registration-Delete dodelete.php sql injection
cve-program ·
Vendor product: Events-Management-System
CVE-2026-112018Published
cgltf through 1.15 Heap Out-of-Bounds Write via cgltf_accessor_unpack_floats()
cve-program ·
Vendor product: cgltf
CVE-2026-109434Published
Sleipnir Browser < 3.9.0 Fullscreen Address Bar Spoofing
cve-program ·
Vendor product: Sleipnir Mobile for Android
CVE-2026-84180Published
Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions
cve-program ·
https://repo.maven.apache.org/maven2: org.apache.camel:camel-knative
CVE-2026-31474Published
can: isotp: fix tx.buf use-after-free in isotp_sendmsg()
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31473Published
media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31470Published
virt: tdx-guest: Fix handling of host controlled 'quote' buffer length
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31469Published
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
cve-program ·
Vendor product: Linux · Vendor product: Linux
CVE-2026-31468Published
vfio/pci: Fix double free in dma-buf feature
cve-program ·
Vendor product: Linux · Vendor product: Linux
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.